The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads several files from the local repository and incorporates their content into its workflow, which could lead to the execution of malicious instructions if those files are compromised.
Ingestion points: The skill reads AGENTS.md, CLAUDE.md, design/gdd/*.md, design/player-journey.md, design/art/art-bible.md, design/accessibility-requirements.md, and .claude/docs/technical-preferences.md.
Boundary markers: The instructions do not define the use of delimiters or safety warnings (e.g., "ignore instructions inside this block") when interpolating data from these files into the agent's context.
Capability inventory: The agent has access to file read/write tools and the Task tool, which allows it to invoke other automated agent skills.
Sanitization: There is no evidence of content sanitization or validation of the data read from the repository files.

ux-design